Justice K.S.Puttaswamy(Retd) vs Union Of India on 26 September, 2018 providers of electronic communications services must, in order to ensure the full integrity and confidentiality of that data, guarantee a particularly high level of protection and security by means of appropriate technical and organisational measures. In particular, the national legislation must make provision for the data to be retained within the European Union and for the irreversible destruction of the data at the end of the data retention period. 184) In BVerfG74, the German Constitutional Court rendered on March 02, 2010 a decision by which provisions of the data retention legislation adopted for, inter alia, the prevention of crime were rendered void because of lack of criteria for rendering the data retention proportional. 185) In Maximillian Schrems v. Data Protection Commissioner75, the CJEU struck down the transatlantic US-EU Safe Harbor agreement that enabled companies to transfer data from Europe to the United States on the ground that there was not an adequate level of safeguard to protect the data. It held that the 74 2.03. 2010, 1 BvR 256 / 08 , 1 BvR 263 / 08 , 1 BvR 586 / 08 75 [2016] 2 W.L.R. 873 U.S. authorities could access the data beyond what was strictly necessary and proportionate to the protection of national security. The subject had no administrative or judicial means of accessing, rectifying or erasing their data. 186) In Szabo and Vissy v. Hungary76, the ECtHR held unanimously that there had been a violation of Article 8 (right to respect for private and family life, the home and correspondence) of the European Convention on Human Rights. The case concerned Hungarian legislation on secret anti-terrorist surveillance introduced in 2011. The court held that the legislation in question did not have sufficient safeguards to avoid abuse. Notably, the scope of the measures could include virtually anyone in Hungary, with new technologies enabling the Government to intercept masses of data easily concerning even persons outside the original range of operation. Furthermore, the ordering of such measures was taking place entirely within the realm of the executive and without an assessment of whether interception of communications was strictly necessary. There were no effective remedial measures in place, let alone judicial ones. The court held: 77. Rule of law implies, inter alia, that an interference by the executive authorities with an individual right should 76 Eur. Ct. H.R. 2016 be subject to an effective control which should normally be assured by the judiciary, at least in the last resort 187) Thus, it is evident from various case laws cited above, that data collection, usage and storage (including biometric data) in Europe requires adherence to the principles of consent, purpose and storage limitation, data differentiation, data exception, data minimization, substantive and procedural fairness and safeguards, transparency, data protection and security. Only by such strict observance of the above principles can the State successfully discharge the burden of proportionality while affecting the privacy rights of its citizens. Indian Kanoon - http://indiankanoon.org/doc/127517806/ 136